refactor: remove --enable-chroot flag, make chroot mode always-on (#714)

* Initial plan

* refactor: remove --enable-chroot flag, make chroot mode always-on

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* refactor: remove --enable-chroot from tests, docs, and workflows

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* refactor: clean up comments referencing optional chroot mode

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* fix: post-process all agentic workflows to use --build-local

Chroot mode is now always-on, which requires the container image to be
built from the current source (matching entrypoint.sh). The 13 agentic
workflows (security-guard, ci-doctor, etc.) were still using
--image-tag 0.13.12 --skip-pull with pre-built GHCR images from before
the chroot-always-on change.

Add all agentic workflow lock files to the post-processing script and
run it to replace --image-tag/--skip-pull with --build-local, remove
sparse-checkout (full repo needed for npm build), and replace the
install step with local build steps.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Co-authored-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com>

Author: Copilot

.claude/skills/awf-skill/SKILL.md

@@ -96,7 +96,6 @@ Container Options:
 Advanced Options:
   --ssl-bump                      Enable HTTPS content inspection
   --allow-urls <urls>             URL patterns for SSL Bump (requires --ssl-bump)
-  --enable-chroot                 Enable chroot for host binaries
 
 Debugging Options:
   --log-level <level>             Log level: debug, info, warn, error
@@ -195,11 +194,11 @@ sudo awf --allow-domains github.com \
   -- cat /data/config.json
 ```
 
-### 6. Use Chroot Mode for Host Binaries
+### 6. Use Host Binaries (Chroot Mode is Always On)
 
 ```bash
-# Access host Python, Node, Go, etc.
-sudo awf --enable-chroot --allow-domains api.github.com \
+# Access host Python, Node, Go, etc. (chroot mode is the default)
+sudo awf --allow-domains api.github.com \
   -- python3 -c "import requests; print(requests.get('https://api.github.com').status_code)"
 ```